Make profile state filters multi-value

Address PR review feedback on the profile-state split: SAML sign-in now
activates a pending profile, deactivation counts owners against the
profile's own organization to close a last-owner bypass, the migration
leaves historical activated_at/deactivated_at NULL rather than
fabricating timestamps, and pending members are no longer rendered with
the deactivated (faded) styling.

Drop the single-value state filter in favor of the multi-value states
across the profile and signatory surfaces. Remove ProfileFilter.state
(only states[] remains) and convert the signatures profileState filter
to profileStates. Turn the console people filter, the CLI
"user list --state" flag, and the n8n listUsers and getAllSignatures
state inputs into multi-select controls, where an empty selection means
all states.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/connect/v1/graphql/profile.graphql

@@ -71,7 +71,6 @@ enum ProfileOrderField
 
 input ProfileFilter {
   contractEnded: Boolean
-  state: ProfileState
   states: [ProfileState!]
   query: String
   role: MembershipRole

pkg/server/api/connect/v1/identity_resolvers.go

@@ -36,10 +36,6 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
 			filters.WithStates(filter.States...)
 		}
 
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-
 		if filter.Query != nil {
 			filters.WithQuery(filter.Query)
 		}

pkg/server/api/connect/v1/organization_resolvers.go

@@ -192,10 +192,6 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 			filters.WithStates(filter.States...)
 		}
 
-		if filter.State != nil {
-			filters.WithState(*filter.State)
-		}
-
 		if filter.Query != nil {
 			filters.WithQuery(filter.Query)
 		}